Re: PHP and user login stuff

[Micah Yoder <LYoder@cyberis.net>]

"Aaron D. Turner" wrote:

> > But without using cookies, I don't see how it would be easy.
> 
> Each form is a cgi.  This is actually very cool way to do forms, since
                 ^^^^
Or mod_perl or PHP script, I assume.

> Perl has a really nice way of creating forms with CGI.pm.  It also allows
> us to create morphing forms which change depending on the need.  Each page
> will read the following values and re-imbed them.

Hmm, maybe I should have looked at that before starting signup.php3. 
But it is closely modeled after signup.php3 on my other project, so code
redesign was minimal.

> > Right.  It will just complicate things for THEM if they don't.
> 
> The problem is that if you don't detect the permament cookie with the
> user/pass you're going to force them to re-create their user.  Oops!  It's
> already in the database.  Now the user has to create a NEW userid.  Yes
> there are ways around this, but now we're doing workarounds because we
> can't guarantee that cookies will work.

There would just be a login form for those that lost their cookie, and
it would be reset.  No big deal.

> > Frankly, I dunno why people do that.  Cookies *are* reasonably secure,
> > at least on OSs that have file ownership and permissions.  :-)  And
> > they're only sent to the site that issued them.  But to each his own.
> 
> Simple.  I don't want people tracking my movements.  Where I go, and what
> I browse is my business, not some corporations.  Also I have no control
> what some idiot programmer puts in my cookie file.  What if Amazon put my
> credit card # in my cookie?  And there have been security concerns over
> Netscapes/IE's implimentation of cookies.

Crap, I just had a look at my cookie file and had no idea how much
garbage was in there!  Maybe you're right to an extent.

Cookies are NOT inherently evil, just overused perhaps.  And storing a
login name to a frequently visited site would be a perfectly acceptable
use IMHO.

About letting corporations track your browsing - yeah, that can be
annoying, but remember that they can only track you on their OWN site. 
Except I did notice some cookies set for ad sites.  THAT sucks.  I
wonder if I can selectively enable/disable sites to accept cookies
from?  That would be sweet.

> strongly against them.  IMHO, if you're a techie, you're more likely to no
> like them, and techies are the ones that will write the entries.

Right.

> No, you forget, Jason is putting a pre-processor wrapper.  It should be
> simple to add two lines of HTML such as I have above to keep state.  Each
> entry would have a comment line :
> 
> <!-- Begin PHP includes
> 
> - -->
> 
> for PHP to scan on to find where to put non-header information.  Keeping
> user login state is just one thing that could take advantage of that.

Hmm, OK, this could work.  In fact, I could even add it to
connect.php3.  It could set a $add2url that contains all the appropriate
info.  Like,

include "connect.php3";
echo "<a href=\"/article314159$add2url\">";

> > I think they buy us plenty.  But I agree there needs to be SOME way to
> > access the system without them.
> 
> That's the point.  You have to impliement a cookie way and a non-cookie
> way.  Why do both?

Well, if EVERYTHING is really handled by a dynamic script, I guess we
don't have to!

Although we could still make it an option on the signup and login forms
to save your handle and password as a cookie.  Then the login form could
automatically log you in.